File scan report
Verdict Safe
Is boiii.
Only 1 of the 69 antivirus engines that checked it raised a generic rule-based alert, while broad submission history and the absence of corroborating high-risk behaviour favor a…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 69 flagged
- Flagged 1
- No detection 68
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Gridinsoft alone flagged the executable with a generic Trojan heuristic; no major antivirus engines agreed, and no malware family was identified. Its 213-source submission history, lack of packing indicators, and absence of corroborated high-risk activity in the test run make that isolated detection likely erroneous, though the unsigned status warrants normal caution.
Only 1 of the 69 antivirus engines that checked it flagged the executable, using a generic rule-based label rather than naming a malware family. No major antivirus engines detected it, and the alert represents one independent engine. The file has been submitted by 213 distinct sources since it was first seen on Aug 17, 2026, providing a meaningful prevalence anchor. The sandbox summary recorded no named injection target or other corroborated high-risk technique; the mapping lacks the artefact needed to support an injection claim. The antivirus analysis also found no packer or unusually high-entropy code. Its unsigned status and unavailable byte-level static analysis limit assurance, but they do not outweigh the predominantly benign evidence.
What We Detected
Gridinsoft was the only engine to flag the executable, producing a generic Trojan rule-based label. The other 74 of the 69 antivirus engines that checked it did not flag it, including the reporting major antivirus engines, and no malware-family agreement exists.
Threat Behavior
The sandbox summary contains a T1055 mapping, but no target process was recorded, so it does not establish process injection. No corroborated high-risk technique or malicious sandbox result was recorded. The antivirus analysis found neither packing nor unusually high-entropy code.
Context and Limitations
The same hash has been submitted by 213 distinct sources, which weighs against the isolated generic detection. However, the executable is unsigned, our static analysis of the bytes was not available, and no complete host-reputation cross-check is available.
What To Do Now
Obtain the executable from its expected official distribution channel and keep security software enabled. If its source or hash differs from what the publisher provides, do not run it until independently verified.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so no verified publisher identity supports its origin.
- Gridinsoft flagged the file with a generic Trojan heuristic, although no other engine corroborated it.
- No completed static analysis of the uploaded bytes or complete contacted-host reputation result is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 69 antivirus engines that checked it flagged the file, and no major antivirus engines detected it.
- The same hash was submitted by 213 distinct sources across 242 submissions.
- No named process-injection target or other corroborated high-risk technique was recorded.
- The antivirus analysis found no packer and no unusually high-entropy code.
- The executable has no verified publisher signature.
- One engine labels it with a generic Trojan heuristic.
- Our static analysis of the uploaded bytes was not available, and no complete contacted-host reputation result is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 6spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1018
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1090
- T1560
Observed activity
Processes started
6Programs the file ran, with their command lines.
boiii.exe"C:\Users\<USER>\Desktop\boiii.exe"boiii.exe"C:\Users\user\Desktop\boiii.exe"msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=boiii.exe --webview-exe-version=2.2.4 --user-data-dir="C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6280.6440.6968879740225811237 /pfhostedapp:bc81aa535164530c34f729f520d2206a25e18504msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView" /prefetch:4 /pfhostedapp:bc81aa535164530c34f729f520d2206a25e18504 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=134.0.6998.178 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --annot…msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=boiii.exe --webview-exe-version=2.2.4 --user-data-dir="C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6280.6440.545341299961422630 /pfhostedapp:bc81aa535164530c34f729f520d2206a25e18504msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView" /prefetch:4 /pfhostedapp:bc81aa535164530c34f729f520d2206a25e18504 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=134.0.6998.178 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --annot…
Files
15Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\EZZ BOIII - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2 - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\84f07371-3097-435d-b74a-29d7d8488d57.tmp - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\BrowserMetrics - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\BrowserMetrics\BrowserMetrics-6A82B9A0-67C.pma
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad\attachments - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad\metadata - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad\reports - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad\settings.dat - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Crashpad\throttle_store.dat - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\ShaderCache - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\ShaderCache\index - Written
C:\Users\user\AppData\Local\EZZ BOIII\WebView2\EBWebView\Variations
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\ezz-boiii-auth-key-lock\Sessions\1\BaseNamedObjects\DBWinMutex\Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!\Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- e06bd26d16b6d7f09337…1339a1Not checkedno saved verdict
- 41c91a9c93d76295746a…1cc304Not checkedno saved verdict
- e54e9d1652848051e07a…4c8461Not checkedno saved verdict
- f7b24f2eb3d5eb055052…8b5fedNot checkedno saved verdict
Chapter 04
Technical details
1 of the 69 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- GridinsoftTrojan.Heur!.02056023
File fingerprint
- Last analyzed
- Sep 10, 2026, 9:17 PM UTC
- SHA-256
06d897a6945a5fe8e8dd8312dcda34f963cf188dd596bc453855309c11ea97c7- SHA-1
4234c9856b4112a7fb90ce39cd22a5124ae7a8ca- MD5
86340ce48b8ef9edfff3c75d26111129
About this file
boiii.exe is a Win32 EXE file of 5.9 MB.
- Type and size
- Win32 EXE · 5.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 17, 2026On VirusTotal.
- Submitted by
- 213 distinct sources
- Packer
- None detected
- Entropy
- 6.25 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
1 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-235 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- GridinsoftMalicious: Trojan.Heur!.02056023
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is boiii.exe safe?
What is boiii.exe?
How many antivirus engines detected boiii.exe?
What is the SHA-256 hash of boiii.exe?
Is it safe to run boiii.exe?
How up to date is this analysis of boiii.exe?
Community
Member reviews and reports for this exact file hash.